INCIDENT RUNBOOK

Fix: Cors Preflight Origin Mismatch in Django on Fly.io

Comprehensive architectural post-mortem and verified configuration patch for django deployed in fly.io production environments.

Automated Remediation ProtocolUpdated for 2026 Production

Facing cors-preflight-origin-mismatch in CI/CD or runtime containers?

Review the verified configuration patches below. To automate incident triage and fine-tune your own internal agents, check out our production AI training datasets.

🧠 Explore Security & Code Datasets →All Runtime Fixes →

● Observed Terminal Error / Stack Trace

TypeError: Failed to set the 'Access-Control-Allow-Origin' header on the response: 'Fly-Proxy' header is not allowed in a response with CORS enabled.
  File "/app/.heroku/python/lib/python3.9/site-packages/django/core/handlers/exception.py", line 47, in inner
    response = get_response(request)
  File "/app/.heroku/python/lib/python3.9/site-packages/django/core/handlers/base.py", line 204, in _get_response
    response = self.process_exception_by_middleware(exception, request)
  File "/app/.heroku/python/lib/python3.9/site-packages/django/core/handlers/base.py", line 202, in _get_response
    response = response.render()
  File "/app/.heroku/python/lib/python3.9/site-packages/django/template/response.py", line 105, in render
    self.content = self.rendered_content

Root Cause Analysis

The Cors Preflight Origin Mismatch error occurs when the browser sends a preflight request to the server to verify if the request is allowed, but the server responds with an origin that does not match the one specified in the request. This is often caused by a misconfiguration in the Django application's CORS settings or a mismatch between the Fly.io platform's configuration and the Django application's expectations. Specifically, the issue arises when the `Access-Control-Allow-Origin` header is not properly set or when the `Fly-Proxy` headers are not correctly handled, leading to a runtime incompatibility between the Django application and the Fly.io platform.

● Configuration & Code Resolution

To fix this issue, update the `settings.py` file to include the following configuration:
--- settings.py
+++ settings.py
@@ -125,6 +125,9 @@
 CORS_ALLOWED_ORIGINS = [
     'http://localhost:3000',
 ]
+CORS_ALLOW_HEADERS = [
+    'Fly-Proxy',
+]
+
Additionally, ensure that the `Fly.io` platform is configured to allow the `Access-Control-Allow-Origin` header by adding the following configuration to the `fly.toml` file:
--- fly.toml
+++ fly.toml
@@ -10,6 +10,9 @@
 [services]
   [services.web]
     [[services.web.ports]]
+    [[services.web.headers]]
+      name = "Access-Control-Allow-Origin"
+      values = ["*"]

Verification & Build Command

curl -X OPTIONS -H "Origin: http://localhost:3000" -H "Access-Control-Request-Method: GET" -H "Access-Control-Request-Headers: Content-Type" https://your-app-name.fly.dev -v